CVE-2025-6541
High
Description
An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Tp-link Er706w Firmware
PublishedOct 21, 2025
First seenOct 21, 2025
Weakness typeCWE-78OS command injection
How to fix
Update
- tp-link er706w_firmware1.2.1 or later
- tp-link er706w-4g_firmware1.2.1 or later
- tp-link er7212pc_firmware2.1.3 or later
- tp-link g36_firmware1.1.4 or later
- tp-link g611_firmware1.2.2 or later
- tp-link fr365_firmware1.1.10 or later
- tp-link fr205_firmware1.0.3 or later
- tp-link fr307-m2_firmware1.2.5 or later
- tp-link er8411_firmware1.3.3 or later
- tp-link er7412-m2_firmware1.1.0 or later
- tp-link er707-m2_firmware1.3.1 or later
- tp-link er7206_firmware2.2.2 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tp-link er706w_firmware | v < 1.2.1, 1.2.1 | 1.2.1 |
| tp-link er706w-4g_firmware | v < 1.2.1, 1.2.1 | 1.2.1 |
| tp-link er7212pc_firmware | v < 2.1.3, 2.1.3 | 2.1.3 |
| tp-link g36_firmware | v < 1.1.4, 1.1.4 | 1.1.4 |
| tp-link g611_firmware | v < 1.2.2, 1.2.2 | 1.2.2 |
| tp-link fr365_firmware | v < 1.1.10, 1.1.10 | 1.1.10 |
| tp-link fr205_firmware | v < 1.0.3, 1.0.3 | 1.0.3 |
| tp-link fr307-m2_firmware | v < 1.2.5, 1.2.5 | 1.2.5 |
| tp-link er8411_firmware | v < 1.3.3, 1.3.3 | 1.3.3 |
| tp-link er7412-m2_firmware | v < 1.1.0, 1.1.0 | 1.1.0 |
| tp-link er707-m2_firmware | v < 1.3.1, 1.3.1 | 1.3.1 |
| tp-link er7206_firmware | v < 2.2.2, 2.2.2 | 2.2.2 |
| tp-link er605_firmware | v < 2.3.1, 2.3.1 | 2.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.